OPS-02 · Secure Operations
Vulnerability management
Vulnerabilities are discovered, prioritized by risk and remediated within stated timeframes, with exceptions recorded.
4frameworks fully address it
4partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC7.1
- ISO 27001FullA.8.8
- NIST CSFFullID.RA-01
- PCI DSSFull11.3
- HIPAAPartial164.308(a)(1)(ii)(B) Through risk management.
- GDPRPartialArt. 32(1)(d) Regular testing of measures.
- EU AI ActPartialArt. 15 Robustness and cybersecurity of the system.
- NIST AI RMFPartialMEASURE 2.7 Security and resilience testing.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Scan output, remediation SLAs, exception records.
?Why it exists
Discovery without a clock is a backlog.
For a smaller organizationMonthly scan, critical fixed in days, documented.